---
typeId: req
recordId: benac-auth-010
fields:
  title: Host-mediated external service authentication
  statement: Benac shall support host-mediated authentication to external services
    through descriptor authentication references, local vault entries, scoped
    credential use, and approved capability grants.
  rationale: Packages need to use APIs and services, but they shall not receive
    raw credentials by default.
  verification: Invoke a package that authenticates to an external service and
    verify that the Host Station injects or applies credentials only through an
    approved operation and redacts secrets from evidence.
  testable: true
  status: draft
  area: BENAC-AUTH
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.2 Authentication and authority boundaries
  order: 25
---
